RBAC (Role-Based Access Control)

Overview

RBAC grants permissions based on assigned roles rather than direct user-to-permission mappings.

RBAC Model

• Users are assigned to roles
• Roles contain permissions
• Access checks evaluate role membership

flowchart LR
    U[User] --> R[Role]
    R --> P[Permission]
    P --> RES[Resource Access]

Practical Example

roles:
  viewer:
    - report.read
  editor:
    - report.read
    - report.write
  admin:
    - report.*

Production Example

A SaaS platform typically maps tenant support staff to read-only roles while operations engineers receive scoped incident management roles.

Common Pitfalls

• Role explosion from overly granular definitions
• Temporary elevated roles never removed
• Missing role review and recertification

Key Takeaways

• RBAC simplifies permission management at scale.
• Clear role boundaries reduce misconfiguration risk.
• Periodic access reviews are required for compliance.